Roles#

A role represents a collection of permissions for Web Manager administrators that can be individually turned on and off.

An administrator can have one or more roles.

An administrator must have at least one role. The first associated role is considered the primary one.

Roles can also be associated to operating system groups. In this way, you can allow access for administrators defined in operating system groups, e.g. using a Domain Controller or other centralized identity management systems, just like you would for an application-level administrator.

A role can be shared between operating system groups and application-level administrators.

Note

The name role is used to avoid confusion with groups of regular accounts.

Adding a new role via Web Manager#

Roles can be added or changed via Web Manager below.

Adding the Application Support Team role in Web Manager, light theme.
Adding the Application Support Team role in Web Manager, dark theme.

Adding a new role via text configuration#

Adding a new role is done by creating a new section inside the configuration file. The name of the section should be prefixed with roles/ and followed by the role's UUID.

The role's UUID can be any unique string used to identify the role. Once defined, the UUID should not be changed.

For more information, please see the dedicated UUID documentation.

For example, to add a new role named SuperAdmins:

[roles/a904e3a6-a59b-4bbf-8abd-edcae4d3774f]
name = SuperAdmins
enabled = Yes
description = Administrators having unrestricted access to Web Manager.

enabled#

Default value:

Yes

Optional:

Yes

From version:

2.1.0

Values:

  • Yes

  • No

Description:

This option specifies whether or not this role is disabled.

When a role is disabled, authentication is denied to all administrators associated with the disabled role.

name#

Default value:

''

Optional:

No

From version:

2.1.0

Values:

  • Any text.

  • Name of an existing group defined in the operating system.

Description:

Human-readable short string used to identify this role.

description#

Default value:

''

Optional:

Yes

From version:

2.1.0

Values:

  • Any character string.

Description:

Human-readable text that describes the purpose of this role.

source_ip_filter#

Default value:

Empty

Optional:

Yes

From version:

4.14.0

Values:

  • IP address access control rules

  • CIDR range access control rules

  • Country code access control rules

  • ASN access control rules

  • Empty

Description:

Acts as source IP activation for this role when an administrator signs in. A matching allow rule activates the role for that administrator's login. A matching deny rule, or no match in a nonempty filter, leaves the administrator unassociated with this role for that login. Leave the filter empty to activate the role from any source IP. Authentication requires at least one associated role to remain active.

See source IP filtering for rule syntax, evaluation behavior, and examples.

permissions#

Default value:

empty

Optional:

Yes

From version:

4.15.0

Values:

  • Multiple lines of comma-separated definitions of permissions

  • target-rule, comma, separated, actions

Description:

This defines the permissions available to administrators associated to this role.

When this is empty, the role has full administrative permissions.

Write one permission definition per line. Each definition contains a target expression followed by comma-separated actions, such as configuration, read.

See Administrator authorization for available targets, actions, evaluation rules, and examples.

external_groups_association#

Default value:

Empty

Optional:

Yes

From version:

6.3.0

Values:

  • External group identifiers, one per line.

Description:

Associates this role with groups from an external identity provider. The authentication method determines which identifiers it supports and how they are matched.

With Entra ID, roles_association = base-and-cloud-groups matches group names or object IDs in this list. Explicit associations take precedence over matching the SFTPPlus role name. Explicit names and IDs are matched case-insensitively, as they are for file transfer groups. When a cloud group has no explicit association, its name is matched to the SFTPPlus role name using case-sensitive comparison.

With roles_association = base-and-cloud-group-ids, only exact object IDs are matched; group names are ignored.

Okta supports explicit group names with base-and-cloud-groups.